How to make a database entry on page load and edit it with later workflows

I am messing around trying to make a simple game and have a question about how to store the id of a database insert for later use.

On page load I have a database insert to make a new entry in a table called game. When the user updates a value on the page I update the value in the game table using a database update.

How can I save the id for the game that was created so I can use it to update the correct table in a secure way?

Can I use global data/query params or would a user be able to modify the value of that and change the id before updating and mess up which game id gets updated? I also saw sessions but I’m not entirely sure how they work or if they would do what I need.

Hope I explained what I am trying to do in a halfway decent manner.

The safest way is to store the data in a stored_ids table.

Hi, Eric!

When creating a game, you can generate unique code, like 1m3d5IBjI1_sQYa6izOJ90z_r_NosKslM-H8E1FDHM7 and then use it in page’s query params to identify game. (find corresponding record in DB before executing every server action)

Yes, if someone knows the code of a specific game, he can mess it up. But with long and unique value it will be hard to pick it.

I’m not sure if this is the best or only option, but I think it would work.

Where would this table be located? And how would I access it? Or are you referring to the data store component?

On a side note, I just realized I could do a DB query in the same workflow as the insert and use the insert identity to then be able to access the ID on page from the query results. Is that a valid solution?

That was my initial thought. I also just thought about using a DB query in the same workflow as the insert and use the insert identity to then be able to access the ID on page from the query results.

Do you see any issues with that method?

I’m not 100% sure that I understand you, but you said it right:

If the user knows the endpoint url, then they can manually send requests with any parameters they want.

Of course you can add registration and authorization to prevent it, but I assumed you want to avoid that.

1 Like